WO2020070973A1 - 復号装置、暗号システム、復号方法及び復号プログラム - Google Patents

復号装置、暗号システム、復号方法及び復号プログラム

Info

Publication number
WO2020070973A1
WO2020070973A1 PCT/JP2019/031129 JP2019031129W WO2020070973A1 WO 2020070973 A1 WO2020070973 A1 WO 2020070973A1 JP 2019031129 W JP2019031129 W JP 2019031129W WO 2020070973 A1 WO2020070973 A1 WO 2020070973A1
Authority
WO
WIPO (PCT)
Prior art keywords
ciphertext
vector
decryption
unit
decryption key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/JP2019/031129
Other languages
English (en)
French (fr)
Japanese (ja)
Inventor
克幸 高島
岡本　龍明
プラティッシュ ダッタ
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Mitsubishi Electric Corp
NTT Inc
Original Assignee
Mitsubishi Electric Corp
Nippon Telegraph and Telephone Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Mitsubishi Electric Corp, Nippon Telegraph and Telephone Corp filed Critical Mitsubishi Electric Corp
Publication of WO2020070973A1 publication Critical patent/WO2020070973A1/ja
Priority to US17/207,087 priority Critical patent/US11909873B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/16—Matrix or vector computation, e.g. matrix-matrix or matrix-vector multiplication, matrix factorization
    • G—PHYSICS
    • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
    • G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
    • G09C1/00—Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0847—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving identity based encryption [IBE] schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • H04L9/3073—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Definitions

  • This invention relates to predicate encryption.
  • Non-Patent Document 1 describes a predicate encryption scheme using an ABP (Arithmetic Branching Programs) predicate. This predicate encryption method allows a wide range of predicates.
  • ABP Arimetic Branching Programs
  • An object of the present invention is to make it possible to realize a predicate encryption scheme that can increase security while allowing a wide range of predicates similarly to the predicate encryption scheme described in Non-Patent Document 1.
  • the decoding device comprises: A ciphertext acquisition unit that acquires a ciphertext in which one of an attribute vector and a predicate vector of ABP (arithmetic branching programs) is set to a base B of a base B and a base B * that are dual bases in a dual vector space.
  • a decryption key obtaining unit configured to obtain a decryption key in which the other of the attribute vector and the predicate vector is set to the base B * ;
  • a decryption unit that decrypts the ciphertext by performing a pairing operation on the ciphertext acquired by the ciphertext acquisition unit and the decryption key acquired by the decryption key acquisition unit.
  • a pairing operation is performed on a ciphertext in which one of an attribute vector and an ABP predicate vector is set in base B, which is a dual base in a dual vector space, and a decryption key in which the other is set in base B *. Then, the ciphertext is decrypted.
  • base B which is a dual base in a dual vector space
  • decryption key in which the other is set in base B *.
  • FIG. 1 is a configuration diagram of an encryption system 1 according to a first embodiment.
  • FIG. 1 is a configuration diagram of a setup device 10 according to a first embodiment.
  • FIG. 2 is a configuration diagram of an encryption device 20 according to the first embodiment.
  • FIG. 2 is a configuration diagram of a key generation device 30 according to the first embodiment.
  • FIG. 2 is a configuration diagram of a decoding device 40 according to the first embodiment.
  • 5 is a flowchart showing the operation of the setup device 10 according to the first embodiment.
  • 5 is a flowchart showing the operation of the encryption device 20 according to the first embodiment.
  • 5 is a flowchart showing the operation of the key generation device 30 according to the first embodiment.
  • 5 is a flowchart showing PGB calculation processing according to the first embodiment.
  • FIG. 5 is a flowchart showing the operation of the decoding device 40 according to the first embodiment.
  • 9 is a flowchart showing a decoding process according to the first embodiment.
  • FIG. 9 is a configuration diagram of a setup device 10 according to a third modification.
  • FIG. 14 is a configuration diagram of an encryption device 20 according to a third modification.
  • FIG. 13 is a configuration diagram of a key generation device 30 according to a third modification.
  • FIG. 14 is a configuration diagram of a decoding device 40 according to a third modification.
  • Embodiment 1 FIG. *** Notation *** The notation used in the following description will be described.
  • the number 101 indicates the security parameter, 1 lambda represents the encoding of unary code.
  • Equation 102 shows a finite field modulo q.
  • the number 102 is described as the field Fq or simply Fq .
  • Equation 103 is replaced by Equation 104.
  • Equation 105 indicates a process of uniformly sampling the element z from the set Z.
  • #Z indicates the size or density of the set Z.
  • Equation 106 shows a sampling process of ⁇ from the output distribution of the algorithm U at the input ⁇ with a uniform random tape.
  • the algorithm assumes that the unary code representation 1 ⁇ of the security parameter ⁇ is given as input, even if it is not explicitly stated as input, if it is clear from the content.
  • Expression 108 indicates the vector shown in Expression 109. Equation 108 is described as v ⁇ .
  • Equation 110 An all-zero vector in the field F q d is written as in Equation 110.
  • Expression 112 shows the inner product of the vector v ⁇ and the vector w ⁇ . That is, Equation 112 indicates Equation 113.
  • Equation 114 shows a multiplicative cyclic group. Equation 114 is described as group G or simply G.
  • group G For the group G and the generation source g of the group G, v indicates a d-dimensional vector of the group element. That is, Expression 115.
  • Equation 116 shows the d-dimensional vector of the group element shown in Equation 117.
  • Equation 118 indicates a unit element of the group G.
  • M (m i, k) denotes a matrix having components m i, k ⁇ F q.
  • M T indicates the transposed matrix of the matrix M.
  • det (M) indicates the determinant of the matrix M.
  • I indicates a unit matrix, and 0 indicates a zero matrix.
  • GL (d, F q ) indicates a set of all d ⁇ d invertible matrices in F q d ⁇ d .
  • PHPE partially-hiding / predicate / encryption
  • the PHPE is a PE (Predicate Encryption) in which a part of the attribute is kept secret.
  • PE Predicate Encryption
  • an attribute vector x ⁇ and an attribute vector z ⁇ are given, where the attribute vector x ⁇ is a public attribute vector to be disclosed and the attribute vector z ⁇ is a secret attribute vector to be kept secret.
  • Equation 120 indicates a set of vertices
  • Equation 121 indicates a set of edges.
  • Equation 120 is simply described as V
  • Equation 121 is simply described as E.
  • V, E is an effective acyclic graph.
  • V 0 and V 1 ⁇ V are special vertices called a source and a sink, respectively.
  • ⁇ is a labeling function for an edge in E.
  • ABP ⁇ in finite field F q calculates the function f shown in Formula 122.
  • the labeling function ⁇ assigned to each edge in E 1 linear expression of one variable with coefficients in F q, or, is a constant in F q.
  • p be the set of all paths from source V 0 to sink V 1 in ABP #.
  • Equation 124 shows the evaluation value of the function ⁇ (E) for v ⁇ .
  • ⁇ Function family F (q, n ', n) ABP @ IP is a function family supported by the PHPE method according to the first embodiment.
  • the function family F (q, n ′, n) ABP ⁇ IP is parameterized by a prime number q and natural numbers n ′ and n, and includes a function f shown in Expression 125.
  • the function f realized by ABP ⁇ is constructed as follows. First, all source vertices of ABP ⁇ j ⁇ j ⁇ [n] are merged into one. Then, one merged vertex becomes the source vertex of ABP #. Next, a new sink vertex for ABP # is generated. For each integer j of j ⁇ [n], from the sink vertex of ABP ⁇ j to the new sink vertex, they are connected by directed edges labeled z j .
  • the size of ABP # for calculating the function f is m + n + 1. 1 corresponds to the sink vertex of ABP #. n corresponds to the number of sides directed to the sink vertex. m corresponds to another vertex of ABP #.
  • ABP # is modified to ABP # 'where each vertex has only one output edge with a primary label. Specifically, ABP # is modified to ABP # 'by replacing each side E in ABP # with a pair of sides labeled 1 and ⁇ (E). ⁇ is the labeling function of ABP ⁇ .
  • the size of ABP ⁇ ′ is also m + n + 1.
  • the ABP @ IP predicate family R ABP @ IP is as shown in Expression 126.
  • the ABP ⁇ IP predicate family R ABP ⁇ IP outputs 1 .
  • the vector x ⁇ and the vector z ⁇ are not 0 when the function f is input, when the function f and the vector x ⁇ and the vector z ⁇ are input, the ABP ⁇ IP predicate family R ABP ⁇ IP outputs 0. .
  • PGB (f; r ⁇ ) is a function f ⁇ F (q, n ', n ) the ABP_ ⁇ _IP as input, using a random r ⁇ ⁇ F q m + n- 1, the function [rho: [ m] ⁇ set of constants with [n ′] ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ′ , ⁇ j ′ ⁇ j' ⁇ [m] ) ⁇ F q n ⁇ (F q 2 ) m Is a probabilistic polynomial time algorithm.
  • n + m-number of assigned values ( ⁇ z j + ⁇ j ⁇ j ⁇ [n], ⁇ j' ⁇ F q n z ⁇ (j ') + ⁇ j ' ⁇ J ' ⁇ [m] ).
  • m + n + 1 is the number of vertices of the ABP for calculating the function f
  • ⁇ is deterministically derived from the function f.
  • the PGB algorithm has the following properties (1) to (3).
  • This set of coefficients is combined with the set of assigned values calculated by combining the output of PGB (f) with x ⁇ and z ⁇ ⁇ F q n to recover f (x ⁇ , z ⁇ ).
  • There is a probabilistic polynomial time algorithm SIM in which ⁇ and f (x ⁇ , z ⁇ ) are input and the output is uniformly distributed with respect to the assigned value.
  • the assigned value is calculated by combining the output of PGB (f; r ⁇ ) for uniformly random r ⁇ with x ⁇ and z ⁇ .
  • Number param G is a bilinear group shown in 127, a prime number q, and multiplicative cyclic group G 1, G 2, G T of order q, and a generator g 1 of the group G 1, generator of the group G 2 g 2 and a bilinear map e shown in Expression 128.
  • the bilinear map e has the following two properties of bilinearity and non-degeneracy.
  • (Bilinearity) Equation 129 holds.
  • (Non-degenerate) Equation 130 holds.
  • the number 131 is the identity element of the group G T.
  • G BPG () is a bilinear group generation algorithm. That, G BPG is an algorithm that generates param G.
  • Param V which is a DPVS shown in Expression 132, is formed by a direct product of param G , which is a bilinear group.
  • param V is a prime number q
  • a d-dimensional vector space V t G t d on F q for t ⁇ ⁇ [2] under vector addition and scalar multiplication defined for each element, and t ⁇ [2 comprising a canonical basis a t shown in Formula 133 vector space V t for, a pairing operation e shown in Formula 134.
  • mapping e in param V has the following two properties of bilinearity and nondegeneracy.
  • Bilinearity Equation 135 holds.
  • Non-degenerate Equation 136 holds.
  • G DPVS (1 ⁇ , d ) is referred to as generation algorithm DPVS. That, G DPVS as input and security parameters 1 lambda of encoding the unary code is, the natural number d indicating a dimension, an algorithm for generating the param V.
  • KP Key-Policy
  • the first embodiment describes the KP-PHPE mode in the attribute only mode.
  • the attribute only mode means that the payload is not included in the ciphertext. That is, the attribute-only mode means that the ciphertext does not include a message to be encrypted.
  • a method of transforming the KP-PHPE mode in the attribute only mode into a KP-PHPE mode in which a ciphertext includes a payload is obvious to those skilled in the art, and can be easily realized.
  • KP-PHPE system is PHP. Setup algorithm and PHP. Encrypt algorithm and PHPE. KeyGen algorithm and PHP. Decrypt algorithm.
  • the Setup algorithm receives the security parameter ⁇ , the length n ′ of the public attribute vector, and the length n of the secret attribute vector, and outputs a public parameter MPK and a master secret key MSK.
  • PHPE Encrypt algorithm, and the public parameter MPK, the public attribute vector x ⁇ ⁇ F q n ', as input and the secret attribute vector z ⁇ ⁇ F q n, and outputs the ciphertext CT.
  • the KeyGen algorithm receives a public parameter MPK, a master secret key MSK, and a function f ⁇ F (q, n ', n) ABP ⁇ IP and outputs a decryption key SK (f).
  • the Decrypt algorithm outputs 1 or 0 with the public parameter MPK, the decryption key SK (f) for the function f ⁇ F (q, n ′, n) ABP ⁇ IP, and the ciphertext CT as inputs.
  • the encryption system 1 includes a setup device 10, an encryption device 20, a key generation device 30, and a decryption device 40.
  • the setup device 10, the encryption device 20, the key generation device 30, and the decryption device 40 are computers.
  • the setup device 10, the encryption device 20, the key generation device 30, and the decryption device 40 are connected via a network.
  • the setup device 10 includes a reception unit 111, a master key generation unit 112, and a transmission unit 113 as functional components.
  • the function of each functional component of the setup device 10 is realized by software.
  • the storage 13 stores a program for realizing the function of each functional component of the setup device 10. This program is read into the memory 12 by the processor 11 and executed by the processor 11. Thereby, the function of each functional component of the setup device 10 is realized.
  • the configuration of the encryption device 20 according to the first embodiment will be described with reference to FIG.
  • the encryption device 20 has a PHP. It is a computer that executes the Encrypt algorithm.
  • the encryption device 20 includes hardware of a processor 21, a memory 22, a storage 23, and a communication interface 24.
  • the processor 21 is connected to other hardware via a signal line, and controls the other hardware.
  • the key generation device 30 has a PHP.
  • a computer that executes the KeyGen algorithm.
  • the key generation device 30 includes hardware of a processor 31, a memory 32, a storage 33, and a communication interface.
  • the processor 31 is connected to other hardware via a signal line, and controls the other hardware.
  • the key generation device 30 includes, as functional components, a master key acquisition unit 311, a function acquisition unit 312, a PGB calculation unit 313, a key generation unit 314, and a transmission unit 315.
  • the function of each functional component of the key generation device 30 is realized by software.
  • the storage 33 stores a program for realizing the function of each functional component of the key generation device 30. This program is read into the memory 32 by the processor 31 and executed by the processor 31. Thereby, the function of each functional component of the key generation device 30 is realized.
  • the decryption device 40 includes, as functional components, a master key acquisition unit 411, a ciphertext acquisition unit 412, a decryption key acquisition unit 413, and a decryption unit 414.
  • the decoding unit 414 includes a residual factor calculation unit 415, a pairing calculation unit 416, and an output value calculation unit 417.
  • the function of each functional component of the decoding device 40 is realized by software.
  • the storage 43 stores a program for realizing the function of each functional component of the decoding device 40. This program is read into the memory 42 by the processor 41 and executed by the processor 41. Thereby, the function of each functional component of the decoding device 40 is realized.
  • the processors 11, 21, 31, and 41 are ICs (Integrated Circuits) that perform processing.
  • the processors 11, 21, 31, and 41 are, as specific examples, a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).
  • the memories 12, 22, 32, and 42 are storage devices for temporarily storing data.
  • the memories 12, 22, 32, and 42 are an SRAM (Static Random Access Memory) and a DRAM (Dynamic Random Access Memory).
  • the storages 13, 23, 33, and 43 are storage devices for storing data.
  • the storages 13, 23, 33, and 43 are, as a specific example, HDDs (Hard ⁇ Disk ⁇ Drive).
  • the storages 13, 23, 33, and 43 are SD (registered trademark, Secure Digital) memory card, CF (CompactFlash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, DVD (Digital ⁇ Versatile ⁇ Disk).
  • the communication interfaces 14, 24, 34, and 44 are interfaces for communicating with external devices.
  • the communication interfaces 14, 24, 34, and 44 are ports of Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface).
  • the operation of the cryptographic system 1 according to the first embodiment will be described with reference to FIGS.
  • the operation of the encryption system 1 according to the first embodiment corresponds to the encryption method according to the first embodiment.
  • the operation of the encryption system 1 according to the first embodiment corresponds to the processing of the encryption program according to the first embodiment.
  • the operation of the setup device 10 according to the first embodiment corresponds to the setup method according to the first embodiment.
  • the operation of the setup device 10 according to the first embodiment corresponds to the processing of the setup program according to the first embodiment.
  • Step S11 reception processing
  • the receiving unit 111 receives inputs of the security parameter ⁇ , the length n ′ of the public attribute vector, and the length n of the secret attribute vector.
  • the length n ′ of the public attribute vector and the length n of the secret attribute vector are both integers of 1 or more.
  • the receiving unit 111 receives, via the communication interface 14, the security parameter 1 ⁇ input by the user of the setup device 10.
  • the reception unit 111 writes the security parameter 1 ⁇ in the memory 12.
  • Step S12 base generation processing
  • the master key generation unit 112 receives the security parameter ⁇ , the length n ′ of the public attribute vector, and the length n of the secret attribute vector received in step S11 as inputs, and inputs a params and an orthonormal dual base ⁇ B ⁇ . , B * ⁇ ⁇ ⁇ [n '+ n] .
  • the master key generation unit 112 reads the security parameter ⁇ , the length n ′ of the public attribute vector, the length n of the secret attribute vector, and the memory 12.
  • Step S13 master key generation processing
  • the master key generation unit 112 has been params and dual basis ⁇ B ⁇ , B * ⁇ generated in ⁇ from [n '+ n], generating a public parameter MPK and the master secret key MSK.
  • the master key generation unit 112 reads from the memory 12 the params and the dual basis ⁇ B ⁇ , B * ⁇ ⁇ ⁇ [n ′ + n] .
  • the master key generation unit 112 generates a partial basis B ⁇ ⁇ and a partial basis B ⁇ * ⁇ for each integer ⁇ of ⁇ '[n ′ + n].
  • the master key generation unit 112 sets the partial basis B ⁇ ⁇ for each integer ⁇ of params and ⁇ [n ′ + n] as the public parameter MPK. Further, the master key generation unit 112 sets a partial base B ⁇ * ⁇ for each integer ⁇ of ⁇ [n ′ + n] as a master secret key MSK. The master key generation unit 112 writes the public parameter MPK and the master secret key MSK into the memory 12.
  • the setup device 10 transmits the PHP. Execute the Setup algorithm.
  • the operation of the encryption device 20 according to the first embodiment will be described with reference to FIG.
  • the operation of the encryption device 20 according to the first embodiment corresponds to the encryption method according to the first embodiment.
  • the operation of the encryption device 20 according to the first embodiment corresponds to the processing of the encryption program according to the first embodiment.
  • Step S21 master key acquisition processing
  • the master key acquisition unit 211 acquires the public parameter MPK generated by the setup device 10. Specifically, the master key obtaining unit 211 obtains the disclosed public parameter MPK via the communication interface 24. The master key acquisition unit 211 writes the public parameter MPK to the memory 22.
  • Step S22 Vector acquisition processing
  • Vector acquisition unit 212 acquires a public attribute vector x ⁇ ⁇ F q n 'and private attribute vector z ⁇ ⁇ F q n. Specifically, the vector acquiring unit 212 acquires, via the communication interface 24, the public attribute vector x ⁇ and the secret attribute vector z ⁇ input by the user of the encryption device 20. The vector acquisition unit 212 writes the public attribute vector x ⁇ and the secret attribute vector z ⁇ into the memory 22.
  • Step S23 encryption processing
  • the encryption unit 213 generates a ciphertext CT using the public parameter MPK obtained in step S21 and the public attribute vector x ⁇ and the secret attribute vector z ⁇ obtained in step S22. Specifically, the encryption unit 213 generates the cipher text CT as follows. First, the encryption unit 213 samples the value ⁇ as shown in Expression 144. Next, the encryption unit 213, as shown in several 145, Iota' ⁇ for [n '] each integer iota the' sampled values phi 'iota', generates an element c '( ⁇ ').
  • c ( ⁇ ) is set as the ciphertext CT. The encryption unit 213 writes the cipher text CT into the memory 22.
  • the ciphertext CT includes an element c ′ ( ⁇ ′) in which a public attribute vector x ⁇ is set to a base B of a base B and a base B * , which are dual bases in a dual vector space, And an element c ( ⁇ ) in which a secret attribute vector z ⁇ is set.
  • Step S24 Transmission processing
  • the transmission unit 214 transmits the ciphertext CT generated in step S23 to the decryption device 40. Specifically, the transmitting unit 214 reads the cipher text CT from the memory 22. The transmission unit 214 transmits the ciphertext CT to the decryption device 40 via the communication interface 24.
  • the encryption device 20 transmits the PHP. Execute the Encrypt algorithm.
  • Step S31 master key acquisition processing
  • the master key obtaining unit 311 obtains the public parameter MPK and the master secret key MSK generated by the setup device 10. Specifically, the master key obtaining unit 311 obtains the public parameter MPK that has been made public via the communication interface 34, and obtains the master secret key MSK that has been transmitted by the setup device 10. The master key obtaining unit 311 writes the public parameter MPK and the master secret key MSK into the memory 32.
  • Step S33 PGB calculation process
  • the PGB calculation unit 313 executes the PGB algorithm with the function f obtained in step S32 as an input, and thereby sets a set of constants ( ⁇ j ⁇ j ⁇ ) for specifying the assigned value. [n], ⁇ j ' , ⁇ j' ⁇ j' ⁇ [m]) ⁇ F q n ⁇ (F q 2) and m, the function [rho: calculating a [m] ⁇ [n '] .
  • Step S331 Matrix expression L generation processing
  • ⁇ ′ indicates an ABP for calculating the function f.
  • ABP ⁇ ′ has m + n + 1 vertices, and the variable z j is set only on the input edge to the sink vertex. Each vertex has only one output side. Therefore, the PGB calculation unit 313 calculates a matrix expression L ⁇ F q (m + n) ⁇ (m + n) indicating ABP ⁇ ′.
  • the matrix L is obtained by removing the column corresponding to V 0 and the row corresponding to V 1 from the matrix A ⁇ ′ -I.
  • the matrix A ⁇ is an adjacency matrix for ⁇ .
  • I is a unit matrix.
  • the following (1) to (4) are established.
  • the matrix expression L includes only ⁇ 1 in the second diagonal, and includes only 0 below the second diagonal.
  • the last column of the matrix representation L is, (0, ..., 0, z 1, ..., z n) is.
  • Step S333 Constant calculation processing
  • the PGB calculation unit 313 selects the vector r ⁇ as shown in Expression 149.
  • the PGB calculation unit 313 uses the matrix expression L generated in step S331 and the vector r ⁇ as shown in Expression 150 to obtain a set of constants ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ′). , ⁇ j ' ⁇ j' ⁇ [m ]) ⁇ F q n ⁇ (F q 2) to calculate the m.
  • a set of constants ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ' , ⁇ j' ⁇ j' ⁇ [m] ) is generated.
  • the PGB calculation unit 313 writes a set of constants ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ′ , ⁇ j ' jj' ⁇ [m] ) to the memory 32.
  • This set of constants ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ′ , ⁇ j ′ ⁇ j ′ ⁇ [m] ) are referred to as ABP predicate vectors.
  • Step S34 Key generation processing
  • the key generation unit 314 sets the public parameter MPK and the master secret key MSK obtained in step S31, the function f obtained in step S32, and the set of constants generated in step S33 ( ⁇ j ⁇ j ⁇ [n ], using a ⁇ j ', ⁇ j' ⁇ j' ⁇ [m]), to generate a decryption key SK (f).
  • key generation section 314 generates decryption key SK (f) as follows. First, the key generation unit 314 samples the value ⁇ as shown in Expression 151.
  • the key generation unit 314 samples ⁇ ⁇ ′ (j ′) for each integer j ′ of j′ ⁇ [m], and generates an element k ′ (j ′) . . Further, as shown in Expression 153, the key generation unit 314 samples ⁇ ⁇ (j) for each integer j of j ⁇ [n], and generates an element k (j) . Then, the key generation unit 314 calculates a function f, an element k ′ (j ′) for each integer j ′ of j′ ⁇ [m], and an element k (j) for each integer j of j ⁇ [n]. Are set as the decryption key SK (f). The key generation unit 314 writes the decryption key SK (f) in the memory 32.
  • the decryption key SK (f) is the base B and basal B * basis of B * is a dual basis in dual space, element k predicate vector of ABP is set '(j' ) And element k (j) .
  • Step S35 Transmission processing
  • the transmission unit 315 transmits the decryption key SK (f) generated in step S34 to the decryption device 40 secretly. Specifically, the transmission unit 315 reads the decryption key SK (f) from the memory 32. The transmission unit 315 encrypts the decryption key SK (f) using the existing encryption method, and then transmits the decryption key SK (f) to the decryption device 40 via the communication interface 34.
  • the key generation device 30 transmits the PHP. Execute the KeyGen algorithm.
  • the operation of the decoding device 40 according to the first embodiment will be described with reference to FIG.
  • the operation of the decoding device 40 according to the first embodiment corresponds to the decoding method according to the first embodiment. Further, the operation of the decoding device 40 according to the first embodiment corresponds to the processing of the decoding program according to the first embodiment.
  • Step S41 Public key acquisition processing
  • the master key acquisition unit 411 acquires the public parameter MPK generated by the setup device 10. Specifically, the master key acquisition unit 411 acquires the public parameter MPK that has been made public via the communication interface 44. The master key acquisition unit 411 writes the public parameter MPK to the memory 42.
  • Step S42 Ciphertext acquisition processing
  • the ciphertext acquisition unit 412 acquires the ciphertext CT generated by the encryption device 20. Specifically, the ciphertext acquisition unit 412 acquires the ciphertext CT transmitted by the encryption device 20 via the communication interface 44. The ciphertext acquisition unit 412 writes the ciphertext CT into the memory 42.
  • Step S43 Decryption key acquisition process
  • the decryption key acquisition unit 413 acquires the decryption key SK (f) generated by the key generation device 30. Specifically, the decryption key acquisition unit 413 acquires the decryption key SK (f) transmitted by the key generation device 30 via the communication interface 44. The decryption key acquisition unit 413 writes the decryption key SK (f) in the memory 42.
  • Step S44 decryption processing
  • the decryption unit 414 decrypts the ciphertext CT by performing a pairing operation on the ciphertext CT obtained in step S42 and the decryption key SK (f) obtained in step S43.
  • Step S441 Coefficient calculation processing
  • the residual factor calculation unit 415 executes the REC algorithm with the function f included in the decryption key SK (f) and the public attribute vector x ⁇ included in the ciphertext CT as inputs.
  • a set of coefficients (( ⁇ j ⁇ j ⁇ [n] , ⁇ ′ j ′ ⁇ j′ ⁇ [m] ) ⁇ F q n ⁇ F q n ′ .
  • the co-factor calculator 415 generates a matrix expression L and a function ⁇ of the function f, similarly to the processing of steps S331 to S332 in FIG.
  • the cofactor calculator 415 calculates the cofactor of the element in the last column of the matrix expression L.
  • the cofactor calculation unit 415 sets the calculated cofactor as a set of coefficients (( ⁇ ⁇ ⁇ j ⁇ j ⁇ [n] , ⁇ ′ j ′ jj′ ⁇ [m] ) in the order of the components.
  • the first m + n ⁇ 1 columns of the matrix representation L contain only the variable ⁇ x ⁇ ′ ⁇ ⁇ ′ ⁇ [n ′], so that the cofactor can be calculated using the public attribute vector x ⁇ .
  • the residual factor calculation unit 415 writes the set of coefficients (( ⁇ j ⁇ j ⁇ [n] , ⁇ ′ j ′ jj′ ⁇ [m] ) to the memory 42.
  • Step S442 Pairing calculation processing
  • the pairing calculation unit 416 performs pairing with the element c ′ ( ⁇ (j ′)) and the element k ′ (j ′). An operation is performed to calculate an operation value ⁇ ′ j ′ .
  • the function ⁇ is the function generated in step S441.
  • the pairing operation unit 416 performs a pairing operation on the element c (j) and the element k (j) for each integer j of j ⁇ [n], and calculates the operation value ⁇ Calculate j .
  • the pairing operation unit 416 writes the operation value ⁇ ′ j ′ and the operation value j j to the memory 42.
  • the decoding device 40 receives the PHP. Execute the Decrypt algorithm.
  • Equation 164 corresponds to calculating det (L ′ (x ⁇ , z ⁇ )).
  • the matrix expression L ′ is a matrix expression obtained by replacing the last column of the matrix expression L with Expression 165. Therefore, it can be seen that equation 166 holds and equation 164 holds.
  • Expression 167 is established. This is because the first m components of the last column are 0, and therefore, Expression 168 is obtained. Therefore, Expression 169 is obtained.
  • the PGB algorithm is executed using the function f as an input, and a set of constants ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ′ , ⁇ j ′ ⁇ j ′ ⁇ [m] is generated. . PHPE.
  • a set of elements k ′ (j ′) and constants corresponding to the element k (j) in Embodiment 1 ( ⁇ j ⁇ j ⁇ [n] , ⁇ j ′ , ⁇ j ⁇ j ′)
  • An element c ′ (j ′) and an element c (j) in which ⁇ [m] ) is set are generated.
  • the elements c ′ ( ⁇ ′) and c ( ⁇ ) of the ciphertext CT and the elements k ′ (j ′) and k (j) of the decryption key SK (f ) At this time, an index is set according to the elements of the public attribute vector x ⁇ and the secret attribute vector z ⁇ .
  • a pairing operation is performed on the elements c ′ ( ⁇ ′) and c ( ⁇ ) of the ciphertext CT and the elements k ′ (j ′) and k (j) of the decryption key SK (f).
  • the index is set so that the added two-dimensional value becomes 0 when the operation is performed.
  • each functional component is realized by software.
  • each functional component may be realized by hardware.
  • the points different from the first embodiment will be described.
  • the setup device 10 includes an electronic circuit 15 instead of the processor 11, the memory 12, and the storage 13.
  • the electronic circuit 15 is a dedicated circuit for realizing the functions of the functional components, the memory 12, and the storage 13.
  • the key generation device 30 includes an electronic circuit 35 instead of the processor 31, the memory 32, and the storage 33.
  • the electronic circuit 35 is a dedicated circuit that realizes the functions of the respective functional components, the memory 32, and the storage 33.
  • the decoding device 40 includes an electronic circuit 45 instead of the processor 41, the memory 42, and the storage 43.
  • the electronic circuit 45 is a dedicated circuit for realizing the functions of the functional components, the memory 42, and the storage 43.
  • the electronic circuits 15, 25, 35, and 45 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field). -Programmable Gate Array) is assumed.
  • Each functional component may be realized by one electronic circuit 15, 25, 35, or 45, or each functional component may be realized by being distributed to a plurality of electronic circuits 15, 25, 35, and 45.
  • the processors 11, 21, 31, 41, the memories 12, 22, 32, 42, the storages 13, 23, 33, 43, and the electronic circuits 15, 25, 35, 45 are referred to as processing circuits. That is, the function of each functional component is realized by the processing circuit.
  • Embodiment 2 FIG.
  • a KEM (Key-Encapsulation Mechanism) system which is a conversion of the PHPE system described in the first embodiment will be described.
  • points different from the first embodiment will be described, and description of the same points will be omitted.
  • KEM version KP-PHPE system based on the PHP. Setup algorithm and PHP. Encrypt algorithm and PHPE. KeyGen algorithm and PHP. Decrypt algorithm.
  • PHPE Encrypt algorithm, and the public parameter MPK, the public attribute vector x ⁇ ⁇ F q n ', as input and the secret attribute vector z ⁇ ⁇ F q n, outputs the ciphertext CT, and the session key KEM.
  • the KeyGen algorithm receives a public parameter MPK, a master secret key MSK, and a function f ⁇ F (q, n ', n) ABP ⁇ IP and outputs a decryption key SK (f).
  • the operation of the setup device 10 according to the second embodiment will be described with reference to FIG.
  • the operation of the setup device 10 according to the second embodiment corresponds to the setup method according to the second embodiment.
  • the operation of the setup device 10 according to the second embodiment corresponds to the processing of the setup program according to the second embodiment.
  • step S11 and step S14 are the same as in the first embodiment.
  • Step S13 master key generation processing
  • the master key generation unit 112 generated params and dual basis ⁇ B ⁇ , B * ⁇ in step S12 Iota ⁇ from [0, n '+ n] , generating a public parameter MPK and the master secret key MSK.
  • the master key generation unit 112 generates a partial basis B ⁇ 0 and a partial basis B ⁇ * 0 as shown in Expression 170, and also generates l ⁇ [n '+ n] as shown in Expression 171.
  • the master key generation unit 112 sets the partial basis B ⁇ ⁇ for each integer ⁇ of params and ⁇ [0, n ′ + n] as a public parameter MPK. Further, the master key generation unit 112 sets a partial basis B ⁇ * ⁇ for each integer ⁇ of ⁇ [0, n ′ + n] as a master secret key MSK.
  • Step S23 encryption processing
  • the encryption unit 213 uses the public parameter MPK obtained in step S21 and the public attribute vector x ⁇ and the secret attribute vector z ⁇ obtained in step S22 to generate a ciphertext C Generate T. Specifically, the encryption unit 213 generates the cipher text CT as follows. First, the encryption unit 213 samples the values ⁇ , ⁇ , ⁇ ′ 0 as shown in Expression 173. Next, the encryption unit 213 generates an element c ′ (0) as shown in Expression 174. Also, the encryption unit 213 sets the g T xi] as a session key KEM.
  • encryption section 213 generates element c ′ ( ⁇ ′) for each integer ⁇ ′ of ⁇ ′ ⁇ [n ′], and generates element c ′ ( ⁇ ′) for each integer ⁇ of ⁇ [n]. Generate element c ( ⁇ ) . Then, the encryption unit 213 determines the public attribute vector x ⁇ , the element c ′ (0) , the element c ′ ( ⁇ ′) for each integer ⁇ ′ of ⁇ ′ ⁇ [n ′], and ⁇ [n ] Is set as the ciphertext CT with respect to the element c ( ⁇ ) for each integer ⁇ .
  • the encryption device 20 transmits the PHP. Execute the Encrypt algorithm.
  • step S34 Processing other than step S34 is the same as that of the first embodiment.
  • Step S34 Key generation processing
  • the key generation unit 314 sets the public parameter MPK and the master secret key MSK obtained in step S31, the function f obtained in step S32, and the set of constants generated in step S33 ( ⁇ j ⁇ j ⁇ [n ], using a ⁇ j ', ⁇ j' ⁇ j' ⁇ [m]), to generate a decryption key SK (f).
  • key generation section 314 generates decryption key SK (f) as follows. First, the key generation unit 314 samples the values r 0 , ⁇ ′ 0 , ⁇ as shown in Expression 176. Next, the key generation unit 314 generates an element k ′ (0) as shown in Expression 177.
  • the key generation device 30 transmits the PHP. Execute the KeyGen algorithm.
  • the operation of the decoding device 40 according to the second embodiment corresponds to the decoding method according to the second embodiment.
  • the operation of the decoding device 40 according to the second embodiment corresponds to the processing of the decoding program according to the second embodiment.
  • step S44 Processing other than step S44 is the same as that of the first embodiment.
  • step S441 The decoding process according to the first embodiment will be described with reference to FIG.
  • the processing in step S441 is the same as in the first embodiment.
  • Step S442 Pairing calculation processing
  • the pairing operation unit 416 performs a pairing operation on the element c ′ (0) and the element k ′ (0) as shown in Expression 181, and calculates an operation value ⁇ ′ 0 . Further, similarly to Embodiment 1, pairing calculation section 416 calculates a calculation value ⁇ ′ j ′ for each integer j ′ of j′ ⁇ [m], and calculates a calculation value for each integer j of j ⁇ [n]. Calculate the value ⁇ j .
  • the pairing operation unit 416 writes the operation value ⁇ ′ 0 , the operation value ⁇ ′ j ′, and the operation value j j to the memory 42.
  • Step S443 Output Value Calculation Processing
  • the output value calculation unit 417 calculates the coefficient set (( ⁇ j ⁇ j ⁇ [n] , ⁇ ′ j ′ jj′ ⁇ [m] ) calculated in step S441 and the operation calculated in step S442.
  • the value ⁇ ′ 0 , the operation value ⁇ ′ j ′, and the operation value j j are read from the memory 42.
  • the output value calculation unit 417 calculates the operation value ⁇ as shown in Expression 182.
  • the output value calculation unit 417 calculates the session key KEM ⁇ as shown in Expression 183.
  • the operation value ⁇ ′ 0 , the operation value ⁇ ′ j ′, and the operation value j j are as shown in Expression 185.
  • the encryption system 1 according to the second embodiment implements the KEM method by converting the PHPE method described in the first embodiment. As a result, it is possible to realize a KEM system that can increase security while allowing a wide range of predicates.
  • the KEM method is configured by converting the KP-PHPE method.
  • the KEM method can be configured by converting the CP-PHPE method described in the first modification.
  • 1 encryption system 10 setup device, 11 processor, 12 memory, 13 storage, 14 communication interface, 15 electronic circuit, 111 reception unit, 112 master key generation unit, 113 transmission unit, 20 encryption device, 21 processor, 22 memory, 23 storage, 24 communication interface, 25 electronic circuit, 211 master key acquisition unit, 212 vector acquisition unit, 213 encryption unit, 214 transmission unit, 30 key generation device, 31 processor, 32 memory, 33 storage, 34 communication interface, 35 Electronic circuit, 311 master key acquisition unit, 312 function acquisition unit, 313 PGB calculation unit, 314 key generation unit, 315 transmission unit, 40 decryption device, 41 processor, 42 memory, 43 storage 4 communication interface, 45 electronic circuitry, 411 master key obtaining unit, 412 a ciphertext acquisition unit, 413 decoding key acquisition unit, 414 decoding unit, 415 cofactor calculation unit, 416 pairing operation unit, 417 output value calculation section.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Computing Systems (AREA)
  • Algebra (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
PCT/JP2019/031129 2018-10-04 2019-08-07 復号装置、暗号システム、復号方法及び復号プログラム Ceased WO2020070973A1 (ja)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/207,087 US11909873B2 (en) 2018-10-04 2021-03-19 Decryption device, cryptographic system, and decryption method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2018188781A JP7117964B2 (ja) 2018-10-04 2018-10-04 復号装置、暗号システム、復号方法及び復号プログラム
JP2018-188781 2018-10-04

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/207,087 Continuation US11909873B2 (en) 2018-10-04 2021-03-19 Decryption device, cryptographic system, and decryption method

Publications (1)

Publication Number Publication Date
WO2020070973A1 true WO2020070973A1 (ja) 2020-04-09

Family

ID=70054732

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2019/031129 Ceased WO2020070973A1 (ja) 2018-10-04 2019-08-07 復号装置、暗号システム、復号方法及び復号プログラム

Country Status (3)

Country Link
US (1) US11909873B2 (enExample)
JP (1) JP7117964B2 (enExample)
WO (1) WO2020070973A1 (enExample)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2023546668A (ja) * 2020-10-23 2023-11-07 エヌティーティー リサーチ インコーポレイテッド 二次関数のための関数暗号化

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6971917B2 (ja) * 2018-06-11 2021-11-24 三菱電機株式会社 復号装置、暗号化装置及び暗号システム
JP7233265B2 (ja) * 2019-03-15 2023-03-06 三菱電機株式会社 署名装置、検証装置、署名方法、検証方法、署名プログラム及び検証プログラム

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011232475A (ja) * 2010-04-27 2011-11-17 Mitsubishi Electric Corp 暗号処理システム、鍵生成装置、暗号化装置、復号装置、署名処理システム、署名装置及び検証装置
JP2012133214A (ja) * 2010-12-22 2012-07-12 Mitsubishi Electric Corp 暗号処理システム、鍵生成装置、暗号化装置、復号装置、暗号処理方法及び暗号処理プログラム
JP2014029415A (ja) * 2012-07-31 2014-02-13 Mitsubishi Electric Corp 暗号システム、暗号方法、暗号プログラム及び復号装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016132547A1 (ja) * 2015-02-20 2016-08-25 三菱電機株式会社 データ保管装置及びデータ更新システム及びデータ処理方法及びデータ処理プログラム

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011232475A (ja) * 2010-04-27 2011-11-17 Mitsubishi Electric Corp 暗号処理システム、鍵生成装置、暗号化装置、復号装置、署名処理システム、署名装置及び検証装置
JP2012133214A (ja) * 2010-12-22 2012-07-12 Mitsubishi Electric Corp 暗号処理システム、鍵生成装置、暗号化装置、復号装置、暗号処理方法及び暗号処理プログラム
JP2014029415A (ja) * 2012-07-31 2014-02-13 Mitsubishi Electric Corp 暗号システム、暗号方法、暗号プログラム及び復号装置

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
BEIMEL, A. ET AL.: "On Arithmetic Branching Programs", JOURNAL OF COMPUTER AND SYSTEM SCIENCES, vol. 59, no. 2, October 1999 (1999-10-01), pages 195 - 220, XP055700369 *
DATTA, P. ET AL.: "Adaptively Simulation-Secure Attribute-Hiding Predicate Encryption", ROBOCUP 2008: ROBOCUP 2008: ROBOT SOCCER WORLD CUP XII; [LECTURE NOTES IN COMPUTER SCIENCE; LECT.NOTES COMPUTER], vol. 11273, no. 558, 27 October 2018 (2018-10-27), pages 640 - 672, XP047502091, Retrieved from the Internet <URL:https://eprit.iacr.org/2018/1093> [retrieved on 20191015] *
WEE, H.: "Attribute-Hiding Predicate Encryption in Bilinear Groups, Revisited", LECTURE NOTES IN COMPUTER SCIENCE, vol. 10677, 2017, pages 206 - 233, XP047453354, DOI: 10.1007/978-3-319-70500-2_8 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2023546668A (ja) * 2020-10-23 2023-11-07 エヌティーティー リサーチ インコーポレイテッド 二次関数のための関数暗号化
JP7841822B2 (ja) 2020-10-23 2026-04-07 エヌティーティー リサーチ インコーポレイテッド 二次関数のための関数暗号化

Also Published As

Publication number Publication date
US20210234676A1 (en) 2021-07-29
US11909873B2 (en) 2024-02-20
JP7117964B2 (ja) 2022-08-15
JP2020056960A (ja) 2020-04-09

Similar Documents

Publication Publication Date Title
JP5291795B2 (ja) 暗号化装置、復号装置、暗号化方法、復号方法、セキュリティ方法、プログラム及び記録媒体
JP6083234B2 (ja) 暗号処理装置
CN102369687B (zh) 密码系统、密码通信方法、加密装置、密钥生成装置、解密装置、内容服务器装置、程序、存储介质
JP5337238B2 (ja) 秘密分散システム、分散装置、分散管理装置、取得装置、それらの処理方法、秘密分散方法、プログラム及び記録媒体
JP5814880B2 (ja) 暗号システム、暗号方法、暗号プログラム及び復号装置
JPWO2019130528A1 (ja) 変換鍵生成装置、暗号文変換装置、秘匿情報処理システム、変換鍵生成方法、変換鍵生成プログラム、暗号文変換方法及び暗号文変換プログラム
WO2012011565A1 (ja) 秘密分散システム、分散装置、分散管理装置、取得装置、秘密分散方法、プログラム、及び記録媒体
JP6059347B2 (ja) 復号装置、復号能力提供装置、それらの方法、およびプログラム
CN110720194B (zh) 重加密密钥生成装置、重加密装置、解密装置及密码系统
WO2018134922A1 (ja) 準同型演算装置、暗号システム及び準同型演算プログラム
WO2019239776A1 (ja) 復号装置、暗号化装置及び暗号システム
US11909873B2 (en) Decryption device, cryptographic system, and decryption method
JP5732429B2 (ja) 秘密分散システム、データ分散装置、データ復元装置、秘密分散方法、およびプログラム
JP6949276B2 (ja) 再暗号化装置、再暗号化方法、再暗号化プログラム及び暗号システム
JP6266130B2 (ja) 暗号システム、マスター鍵更新装置及びマスター鍵更新プログラム
JP7233265B2 (ja) 署名装置、検証装置、署名方法、検証方法、署名プログラム及び検証プログラム
JP6189788B2 (ja) 鍵生成装置、再暗号化装置、およびプログラム
JP2019117232A (ja) 暗号化装置、復号装置、暗号化方法、復号方法、プログラム
WO2017203743A1 (ja) 暗号化装置、復号装置及び暗号システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19868854

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19868854

Country of ref document: EP

Kind code of ref document: A1